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RE MARKS 



1 he f- \ammet has {ejected ( ' amis ~-2" unJet S( 101 a c bem<a dneued 
towatd non-statutoi\ subject mattet Vpphcant has claufled independent C iaurts 7 and 
17 k> mdude a computer pioymnj ptoduet "embodied on a tangible compute! readable 
mtdmnV m oidci to a\otd such rejection 



1 he f xammei has \ peeled Ham* "-H lo-24 2"" 14-40, 4*-M ^4 t>l-6" "0- 
~8, and <s'l midei ^US( 10 Ma) as bemg uipalemable o\et Ilntskactal {l"s Patent 
No o V^t-x") m \ teu or U Pennee et al il h Patent No <.,tf92,3 f >;? t i wther the 
PXammet has l.fectedC laun- I4-IS 2^-2b 41-42 -2-v<, W-&> and ""-SO undei ^ 
T S t 10 ><a? as being unpatentable o\ei iinisUi m view of i e Pennec blither tn a few 
ofCaeunale tl S Patent Publication \o 2002 012927"} \pphcant iespccttuih 
di>aj.iee^ \\ ith sue h tejecunn especta'K in \ ie\s oi the amendments made heiemaUn e to 
the independent claims Specifies IK, applicant ba c amended the independent daima te> at 
lea-t substantial include the subject watsei ol dependent ( (aim 14 et a! 



W uh tespnJ to the independent claims ihe F\annnei has id ted on the follow nig 
e\L.ejpts iiom Hunka and 1 e Penues. to make a puoi att •dtowiuL' of applicant s daimed 
technique ' w herein said assessment computes stoies a database ot comptitet tiles and »ajd 
database includes l<n each compute! Ide a persistence llaa indicating w helhei an emu 
iclatina to t>aid computet file sheukl be putted tiom ^tid database dm my puii>e 
opeiations (see tins ot stmdat but not neeessanK identical latiuuaue in the independent 
claims). 




Vuus f-« CVuttfissM C**« Tiisfc 0SM1 




Applicant tespeUfuih asseits that the e\tctpls ftom 1 Intska lclted upon by the 
l:\aminer meteh leach that '|a file s] cheduura is added to the if ie server's list of 
checksums of autliotued files ' and that 'ftjhis procedure mas be used in addition to the 
inclusion m files of data indicating whethei the file hn\ been <mthon/ed or batted horn 
use " lKn\e\et Hruska's disclosure of an authon/ed file's checksum being stosed in a 
file *euei \ list of checksums m no was suggests a technique '"wheiem said assessment 
computer stores a djtatosei^f computexft (emphasis addedt as claimed b\ applicant 
L leads a hst of checksums, where such checksums arc of the Jjjcv as in Hruska, does not 
meet applicant's claimed database of computer files, as claimed. 
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!n the Office Action dated 03/27/2007, the Examiner has argued thai 'the 
combination of Hruska and Le Pennec replaces the checksum database with the database 
of virus-free certificates which fails within the scope of "computer file Y 

Applicant respectfuily disagrees. Le Pennec simply teaches that "[a] specific 
process associates a Certificate , called virus-free Certificate (VCh with a file" (emphasis 
added). However, merely teaching the association of a certificate with a file, does not 
teach a technique "wherein said assessment computer stores a database of computer files" 
{'emphasis added), in the context claimed by applicant. 

hi particular, applicant notes that Le Pennec discloses that "the only process 
performed by the system receiving the file... is to verify the file against the file signature 
included in the virus-free Certificate'" {Col. 6, Hues 3-6). Clearly, a database of 
certificates that is used to verify the file, as in Le Pennec. cannot meet applicant's 
claimed "database of computer files,' " particularly since such "database includes for each 
computer file fields specifying... data identifying said requesting computer / where the 
" computer file [is] to be accessed by said requesting computer " (see the same or similar, 
but not necessarily identical language in the independent claims - emphasis added), in the 
context claimed. 

I uithennoie applicant rcspeUtuiK duetts that the Itgiues and associated evtcipt 
fiom Le Pennec relied upon b\ the b vara nor simplv teach [a" specific ptocess [that] 
associate <■ a ( eitificale tailed \nus-fiee ( entile ue <\ ( } with a tile m order to >peed up 
and impioxc the \ irus detection \dd tumalK I e Pennec discloses a \ uus-hce 
Leitificate t ache Table [which] is dutainicaih built b\ the \ t C and compiise^ a local 
cops ol \ itus-hee t ertiticate n inch ha\e been tiansmitted thtouuh the L \\ \\ \\ 
network and that [t]hc table (SOI) iompme-> for each file , one ot multiple associated 
\ uus-hee (. ertificates (Col 14 hne66-(ol fine 4 emphasis added) 



In addition 1 e Penned discloses that the \ uu->~fiee ( etttUcate Section mc hides 
fields lo! a \ uu^-fice f eiUiie tie (^O 1 *) "a 1 1 a\t Date (MO) and a k \umbet Hits 
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(\ sg ^} where the u 't 51 1 1 \umbei Hits is the numbei of requests (hits) that 
have been received b\ the Y( Cache to iciitoxe thi- \ C " and that % (i]\pii.a!lv this 
numbei of hif is u^ed w hen the \'C CaJte is maintained and svhen fut instance the 
icc<^>ids w ith the low est numbei or bus has e to he deleted '(Col I ^ Unes ^0-5 ! 
emphasis added} Furthei be 1'emiec disdu-es that '{704} tests whethci oi not the VC 
C ache 1 able is full if the \ ( t. aJie i able is full {"05 > deletes 'ome ieeoid of the \'( 
Cache I abic (706C and '[tjvpiealk the reioids which ate deleted ate selected acioidmg 
t° the 'M ast Pate" and "Xumhei Hits" fields" (( ol I 7 , lines "^-o4 empha^a added) 

!lowe\eK the mete disclosure that ths. Numbei_llits ate used when the \ C ( ache 
Table is full and the iccouls \s tth the lowest nurobct ot hits base to be deleted, as in 1 e 
Pounce in no \sn\ suggest a technique w hetem haul assessment computer stores a 
database of computer files and ^aid database includes foi each computer file a peiMstence 
flag indicating whether an enm telamig to saul computet Hie should bo pinged from iaul 
database during purge opei ation^' (emphasis added K a?> c iaimed b\ applicant C learh , 
allowing a tecoid to he deleted when the table is full ba^ed on the 1 ast Date and 
Numbei Hi ts lie Ids especially where such Numbei_Hits field identifies a numbct uf hits, 
fads to suggest an\ sort of' pet ^tstencc Hag," in the manner as claimed b\ applicant 

In the Office Action dated 03 2"* 200"' the CXaminer ha* atgued that " 1 1 jhe claim 
tequues that the ' persistence Hag" tndicatejsj w hethei au enm ui the database should be 
puiged fioro said database during purge opeiations* and that *[t]he 1 number of hits' is 
u>ed to detuunne which entries will be ietno%ed from the database dating purging (when 
the database is full and a new entn is to be added) 

\pplicant iespecttul!\ disagtees and points out that Le Pounce sunpiv dtsdoses 
that the '\umhei Hits is the nuntbet of teqtiests (hits) that iune been iccened In the 
^ ( s ^he to iettie\e ja \ trus-free C ertifjcatej and that this numbei of hit.-, is t;sed 
when the \ C Cache is maintained and when fot instance the iecoid° with the lowest 
number oi hits base to he deleted ' {eiuphasj- added) Howe\et mere!) stoung the 
number of requests to tetnexe a certificate in a iccoid in addition to maintaining a cache 



- 20 - 



and deleting aeuids w uh the km est uumbei of hn> as m J e Pumic does not 
specifically disclose am aott ot a persistence flag as claimed let alone " a persistence 
fiau indicating ^heihet an enttv i elating to said computer file should be putted fsom .said 
database dun mi pmue opeianons" {emphasis added} a-- claimed b\ applicant 

AddiUonalh with tespect to the independent claims the fc \amirtoi has iched on 
} iguie ^ element 504 {teptodiiced aho\e) and I fgitie 3 clement *U)4 horn Le Pennee to 
make a pi iui ait showing ut applicant's claimed technique w heietn said database 
includes ioi each computet Hie fields specifying a filename of said computet file data 
uieutifung said Kqucstm*; computet and a stotage locatioa of said computet tile * 

\pphc\mt iespecublh as>ctts that, sn 1 e Pennee 1 Ki ^ desutbes the Ynus-ftee 
Ccititicate Cache fable according to the picsent i mention * {;>ee Co! <\ lines 4o-P}, and 
thai 1 [i in the YC < 'ache Table each 1'iic is identified b\ the File name the file i>pe 
optumalls . the file size, [and] the file C RC " Usee Col I s Sines ^-10 emphasis added) 
1 iowe%ei, meteh disclosing that the file io identified b\ the file name file t\pe file si/e, 
and file t. K< as in 1 e Pernio fails to e\en surest a technique "wheiem said database 
includes fot each computet file tie his specifi, ing a filename iff said eompuiei file data 
uientiismq said lequestina computet and a stotaa.t location of said computet file and a 
checksum xaiijo calculated front said computet file * t emphasis added} as claimed bv 
applicant. 

1 iiithfr, in the Office Action dated 0^ Z'' 200" the 1 x a turner has atgued that 'I e 
I'ennec does in tact teach the database having fields ioi "a filename of said computet 
file" as seen tn 1 ig 3 Element 30^ 'data identifying said lequesttng computet and a 
sroiage location uf said computer file" a,? .seen m I'ig * Clement 304 and Co! 10 Lines 
27-^2 and v 'a checksum \alue calculated fions said computet file" as seen tn fig ^ 
Element 507.' 



Applicant respectfully disagrees and asserts that item 304 m Figure 3 of Le 
Pennee simply discloses an Identifier for a source system, such as "the IP address of the 
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i ile V-s\c-j winch hat* ongmatcd all files within a specific softwaic u»mpan\" {( ol 10. 
biic-' 2o-"U ) (JcaiK I e Pennee s disclosure of an identifiei of a smrrce of a fik as 
iehed on bs th<- Fvumnej foils to disclose that said datable includes tot each computet 
file fields specifying data identifvinu said ltxiucsti mi computer * patttcniatix vxhete ' a 
compute! Isle [isj to be accessed bv said icquesttng computet (emphasi,-, added), m the 
context claimed by applicant. 

To establish a prima jack case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary' skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference for references when combined) 
must teach or suggest ail the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior an and not based on applicant's disclosure. /// re l 'aeek,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.199l). 

\ppbcant tL-.pet.tfui Is asserts that at least the thud element of the pi/iiu hu >>. 
ca^e of obviousness has not been met since the prior au erupts <i, ithed upon b\ the 
bXammer tail to teach ot suggest aU of the Uaim limitations as noted above 
Nevettheios despite such paramount deficiencies and m the spurt of expediting the 
pioseuition of the ptesetit application, applicant has substantial mcorpoiau-d the subject 
mattu ol dependent t. ianu 14 et ai uito the independent clatnts 

W ith respect to the subject matte! ol t lami 14 et ai {now at least subatantiallx 
incoj poiated into the independent claims* the 1 \ammer has iehed on ( ol 4 hues 
fiom the ll!uska tefeieme m addit'on so pat tguph [007^] of the L .ucaxale tcleience to 
make a pnoi ait showing of applicant s claimed technique w hetem satd assessment 
computet operable m at least a haghei level secumx- mode and a iowu level svcuntx 
mode said assessment computet sytx mg to deux access to a greatet tauge of computet 
files when opeiaiuig in said lughei level st\uuv mode compaied with said lowei level 



- 22 - 



vcunt\ mode' (set- timet simtlat but not nect<Narilv identical language tn the 
liidcpendeiu claims) Applicant iopet-itulK notes that the f \anunu has cited ' Hniska 
Paiagiaph (>0~s 1 on I'age 8 of the { HTice \ction dated 2 7 2007, winch applicant 
mteiptets as pasagsaph [00"*;] of the C act a\ ale leferenee 

Vppbeant respectful i\ points out that the abo\ e e\ceipt irem Huiska tehed on b\ 
the ! \ammu meieK teaches that an o petatof of the woik*tatK>n can nntrnct the \ ahditv 
of au> oi ail hie* stoied fei access in the woikstation to Ik checked (t. ol 4 lines S^s" 
- emphasis added) f utthet applicant notes that the abov c e\capt horn Catcavalc 
stmph teaches that w hen a " % uus checker piogram is incapable of detecting a new 
virus the supplier of the anu-vnits progtam will dismbitte an updated pattern file thai 
ma\ be used bv the conventional vims cheekei progtam to detect the new a hus" 
ipata<>iaph j(X)7^] emphacas added) 

Howe\*u onl\ teaching that an ope; atot can instinct file \ahdm to be checked as 
in lluiska and that an anti-uius pto»iam supplier disti Unites an updated pattern tile to 
detect a new virus as hi ( accavale does not t\a\ su gg est a technique wheiem said 
as^es-nienf womputei is operable in at lea>t a highet level >ecunty mode and a Sower level 
Svcnnts mode said assessment computet sen mi: to deny access tj a greater range of 
computet isles when operating m s<nd higher level secuiirv mode compaied with 3 aid 
low ei level „->ecunt> mode' (emphasis added > as claimed bv applicant Ckailv the 
opeiator instructing foi the vahdnv ot all files stoieU fot access to be checked as m 
Hiuska >impl\ tails to even suggest that "said assessment computet <erv|esj to denv 
access to a greater range ol computet files when opeiating in said Snghei level security 
mode compaied with said lowet level secuntv mode t emphasis added), tn the mantiet ,i-> 
claimed bv applicant. 

Again applicant lespectfdlv asserts that at least the thud element of the puma 
tuC'i cast- of obviousness \ Xds no t been met, as noted above i bus a notice allowance 
oi specific piioi ait showing of each of the fotegomg claim elements, ni combination 
with the iemammg claimed featujes is icspccilullv ie<[uested 
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Applicant iluthci notes that the prun an is ai-'o deficient vuth respect to the 
dependent claims f-oi example w nh respect to Claim 12 et a! the hxammei has lelsed 
on ( ol \ hues S'l-18 from the Hiuska lefetence to make a piioi ait showing of 
applicant's claimed technique "wheiem said database of computet tiles specifies whether 
respecmc compute! file-- contain maiwate" (see thi-- ot sismlai. but not necCssanK 
identical language in the aforementioned claims). 

Applicant respectfully points out. that, the above excerpt from Htuska. relied on by 
the L\ammes mtkh teacher that " [\\f the file s,> then authorized b\ the stipemsor it ^ 
checksum is added to 1 the file senei's im ot ched-Hm^ ot authou/ed files and that \\ 
iepoH message is ieturned to The tele\ant notkitation indicatinc. that aece>s to the + de can 
be allowed' {Col ** lines 1* l'> emphasis, added} ihns the list of checksums 
di^cloj-ed in Uutska »ul> includes cheek<-umo tor which file.-- aie authou/ed s\hfch does 
not k\kh 01 suLget>t that ' said database ot computer files specities uhethei iespecme 
computes tiles contain mah\ ate (emphasis added) as claimed Intact applicant 
icspectUilK points out that smce the checksums m Htuska arc onh added tc> the list of 
checksums it the associated *lle-> aie anthon/ed such h>t of checksums is oniv associated 
\uth atithoti/ed files such that there would ht no need to "| speeds vJiethet lespteme 
computet liles contain malwaie as appheant claims 

\ddmonall\ applicant notes that Hiuska teaches "the inclusion m file.-- ot data 
indicating whethci die file has been atithon/ed ot barred funn use t( ol ^ hne^ 2^-2^ 
emphasio added} Ho\\c\ci meieK including in a file data indicating whetlui the file is 
authofi/ed oi haned, a-» m f huska does not teaJi a technique 'uheiem said database ol 
compute} files specifies \\hetba respecme computet tiles contain maKsare < s emphasis 
added), as claimed by applicant. 

Vdditionalh with tespect to i. Lum is ct al the I \ammer has idied on ( ol 5 
frue^ "s^-s7 from the Ihuska lefeience m addition to patagtapb [0(>~5] of the ( accaxale 
teietenee to make a pssoi ait slum iuu of applicant's claimed technique '\\heiem ->aid 
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assessment computet is tuggeted to diamae from said hnvet ie\d steuutv modt 10 said 
htghe? !c\el siYunts mode b\ a lock down tnggei message leve-ived at siud assessment 
computet fu >m a i emote computer ts.ec this ot simiiat but not necessarik identical 
language in the independent claims,} Applicant icspectfulh rune*-- that the Kamsner has 
cued "Ihuska Paidgiaph OCT" utt Page 8 of the Dtticc Action dated 0^ 2" 2007 which 
applicant tnteipteto as paiagiaph [007^] of tht- C accaxale tefere.net* 

\pphcant iespectihlh asserts tliat the above txcetpt lioin Hui^ka iched on b\ the 
F xaminei meieh leaches that "an opciatot o the xvoi testation can instinct tlie xaltdm of 
ao> ot ali files stotcd fot access b\ the woikt ration to he checked (I ul 4. hues 
emphat>L-> added} Addtuonulh applicant pomtb out that on Page 3 of the Ultke Action 
dated 03 27'200" Y the Lxaimner adtntta that I intska kuifsj to disclose a message being 
sent to the file server indicating a ^w iwh to a mode of operation wheiL-m more fi!e> aie 
denied lot access " Furthei, applicant tespcululb as^ettb that the e^ectpt from 
Oacunale simph teacher that when a "urns ^hecke* progiam is incapable ot djtectinu a 
new % tins the snpphei of the anti-x niu progiam will dwnbutc an updated pattern hie 
that ma\ be used In the conventional \suis eheckei progiam to detect the new Vitus' 
(paiagiaph j0U7sj - emphasis added) 

Howexcr, teaching that an opei ator can instinct file v ahdu\ to be checked, m 
addition to teaching that an autt-vuus piogram supphet distribute^ an updated pattern file 
to detect a new \ uus doe^ not e\ en suggest a technique "w heieiu said assessment 
compute! tnggeied to change ftoiu said iowet level sccuutv mode to said lughet level 
scent it\ mode bv a lock down ttt g gct message tecened at -\isd assessment computer fu>m 
a t emote computer" (emphasis added) as claimed b\ applicant 

Again, oinee at least the thud element of the prima a '< h' case of oln foulness lias 
not been met as noted above a notice of alh wattce oi specific piiot ait showing ot each 
of the foiegomg claim elements m combination u ith the icmammg claimed ieattues, is 
i espect 1 ul 1\ i equested. 



Still \et applicant brings to the i\\ammei\s attention ihe Mibjeu mattet of new 
C laims 8 >-S4 below, which <tie added fur full consideration 

1 wherein said flic access cieatance t espouse indicates access to said 
computet file is dented ifsaid computer file has pte\iousl) been identified as 
containing malware. and said denied access i espouse includes deletion of said 
computer file" {see Claim £OK and 

1 whetetn said higher le\el seunitv mode include < banning access to at 
least one ptedetet mined toimat ol\omputet files ' (see Chun 84 > 

\yaui a notice uf allowance ot a ptupct pttoi <nt showing oi al| of applicant s 
claim limitations, m combination nith the remaining dams elements is tcspecttnlh 
requested. 

1 1 ins all of the independent Jaims ate deemed allowable Moteovet, the 
iemaiomy dependent claims ate furthei deemed allowable tn \se\% of then dependence 
on such independent claims. 

hi the c\enf a telephone comeisaUon would expedite the prosecution of this 
application the 1 xammei rna> teach the undersigned at (408) ^0^-5100 The 
Commissioner is authorised to charge am additional tees oi credit am o\eipa\metit to 
Deposit VeoiiiuNo ^0-Llsl {Oulet \u V\llP4oS) 

Respectfully submitted, 
Zilka-Kotab, PC 
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